| Denial of service in github.com/shamaton/msgpackCVE-2026-32284 · GHSA-H9Q6-HC68-35RPبازه‌ها نیاز به بررسی دارند. |
github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v3 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerCVE-2026-34230 · GHSA-V569-HP3G-36WR |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter valuesCVE-2026-26962 · GHSA-RX22-G9MX-QRHV |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart byte range processing allows denial of service via excessive overlapping rangesCVE-2026-34826 · GHSA-X8CG-FQ8G-MXFX |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack has Content-Length mismatch in Rack::Files error responsesCVE-2026-34831 · GHSA-Q2WW-5357-X388 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-RedirectCVE-2026-34830 · GHSA-QV7J-4883-HWH7 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingCVE-2026-32762 · GHSA-QFGR-CRR9-7R49 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack:: Static header_rules bypass via URL-encoded pathsCVE-2026-34786 · GHSA-Q4QF-9J86-F5MH |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart parsing without Content-Length header allows unbounded chunked file uploadsCVE-2026-34829 · GHSA-8VQR-QJWX-82MW |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rails Active Storage has possible Path Traversal in DiskServiceCVE-2026-33195 · GHSA-9XRJ-H377-FR87 |
Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rack has a Possible Information Disclosure VulnerabilityCVE-2025-61780 · GHSA-R657-RXJC-J557 |
OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8OpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parametersCVE-2025-59830 · GHSA-625H-95R8-8XPM |
OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8OpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rack::Request accepts invalid Host characters, enabling host allowlist bypassCVE-2026-34835 · GHSA-G2PF-XV49-M2H5 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parametersCVE-2026-34827 · GHSA-V6X5-CG8R-VV6X |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rack has a root directory disclosure via unescaped regex interpolation in Rack::DirectoryCVE-2026-34763 · GHSA-7MQQ-6CF9-V2QP |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rails has a possible XSS vulnerability in its Action View tag helpersCVE-2026-33168 · GHSA-V55J-83PF-R9CQ |
Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsCVE-2026-33174 · GHSA-R46P-8F7G-VVVG |
Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rails Active Storage has possible content type bypass via metadata in direct uploadsCVE-2026-33173 · GHSA-QCFX-2MFW-W4CG |
Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rails Active Storage has possible glob injection in its DiskServiceCVE-2026-33202 · GHSA-73F9-JHHH-HR5M |
Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefCVE-2026-25500 · GHSA-WHRJ-4476-WVMP |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
